AI Browser Agents in 2026: What They Can Safely Do

AI browser agents are the first genuinely new thing browsers have done in a decade. You give one a sentence, and it clicks through pages, fills forms and completes the task while you watch. The demonstrations are impressive. The security model underneath them has a hole that nobody has closed, and it is worth understanding before you hand one your inbox.

Written September 2026. This is a fast-moving area and the defences described here are improving, but the underlying problem has not been solved.

What AI browser agents actually do

A traditional browser waits for you to click. An agentic browser reads the page the way a person would, decides what to do next, and acts. That means it can follow a multi-step task across several sites: find a flight, compare two products, fill in a returns form, pull a reference number out of an email.

The capability that makes them useful is exactly the capability that makes them risky. To be helpful the agent needs to read page content and act on what it finds. It has no reliable way to tell the difference between content it is meant to read and instructions someone has planted for it to obey.

The flaw: prompt injection

The attack is called indirect prompt injection, and it is disarmingly simple. An attacker puts text on a page that reads as an instruction. The agent processes the page, treats that text as something it should do, and does it.

The text does not have to be visible to you. Brave’s security researchers demonstrated the attack against Perplexity’s Comet browser using instructions hidden in white text on a white background and inside HTML comments. In their demonstration the agent could be steered into fetching a one-time passcode from the user’s email and acting on a banking portal.

This is not one vendor’s bug. OWASP put prompt injection at the centre of its 2026 assessment of agentic AI risk, and documented findings against Slack AI, Microsoft 365 Copilot, Cursor and GitHub MCP among others. In May 2026 the Five Eyes agencies, including CISA and the UK’s NCSC, issued joint guidance naming prompt injection as a core method of manipulating agents and telling organisations to assume agentic systems may behave unexpectedly.

Why it is hard to fix

A normal security boundary separates code from data. The database knows a query is a query. A language model has no such boundary: instructions and content arrive as the same stream of text. Vendors have added filters, confirmation prompts and sandboxing, and these help. None of them turn an unreliable distinction into a reliable one.

Treat any claim that prompt injection has been “solved” with suspicion. The honest position from the research community is that the problem is mitigated, not eliminated.

How to use AI browser agents without getting burned

None of this means the tools are useless. It means the trust you extend should match what an attacker could do with it. A practical way to think about AI browser agents is to sort tasks by what goes wrong if the agent is hijacked mid-task.

1. Safe: reading and summarising. Comparing specifications, pulling facts out of long pages, summarising documentation. If an agent is hijacked here the worst outcome is a wrong answer, which you can check.
2. Careful: filling forms with data you supply. Fine when you review before submitting. The agent proposes, you press the button.
3. Risky: anything with your logged-in session. Email, banking, cloud storage, admin panels. A hijacked agent inherits every permission your browser session already has.
4. Do not: spending money or moving data unattended. No current agent should be left to complete a purchase or a transfer without you watching each step.

Practical settings that reduce the blast radius

• Use a separate browser profile. Give the agent a profile with no banking, no email and no password manager attached. This single step removes most of what an attacker would want.
• Keep confirmations on. If the agent offers to act without asking, that setting is convenience bought with your security.
• Watch the run. Agent hijacks are usually visible: the agent navigates somewhere you did not ask about. If you are not watching, you will not catch it.
• Log out of what it does not need. Session cookies are the currency here. An agent cannot abuse an account it is not signed into.
• Be wary of untrusted pages. The risk rises sharply when you point an agent at a page you did not choose, such as a search result, a forum thread or a link from an email.

What this means for the next few years

Agentic browsing is not going away, and the productivity case is real. What is likely to change is where the work happens. Expect more of it to move into sandboxed environments with narrow, explicit permissions rather than running inside the browser you use for everything else, and expect sites to start declaring what agents may and may not do on them.

Until that arrives, the useful mental model is that AI browser agents are a very capable assistant reading over your shoulder who will believe anything written on a page. That assistant is genuinely helpful for research. It should not be left alone with your bank.

If you are also weighing how much to trust what these systems tell you, our guide on how to check an AI answer covers verification, and spotting a phishing email covers the older attack these agents make easier to fall for.

How to judge whether an implementation is careful

Vendors are not equally cautious, and the differences are visible if you know what to look for. When you are deciding which tool to let near your accounts, these are the signals that separate a considered design from a demo.

• Does it show you what it is about to do? A careful agent surfaces the action and the destination before acting, not a spinner and a result. You cannot supervise what you cannot see.
• Does it stop at money and credentials? Purchases, transfers and password entry should always break the loop and hand control back, no matter how confident the model is.
• Is the session isolated? Better designs run in their own browsing context rather than borrowing the cookies from your everyday tabs.
• Does the vendor publish its failures? Teams that publish red team results and known limits are usually the ones taking it seriously. Silence is not evidence of safety.
• Can you restrict where it goes? Allow lists, or at minimum a prompt when the agent leaves the site you started on, sharply limit what a planted instruction can reach.

What website owners should do about it

If you run a site, agents are already reading it, and you have a small part to play in this. Two things are worth doing. First, do not put instruction-shaped text in hidden elements, because legitimate hidden text trains people to ignore a real warning sign. Second, treat agent traffic as untrusted input on anything that changes state: an agent submitting a form should face the same rate limits and confirmation steps as a script would.

There is also a content angle. Pages that state facts plainly, with the answer near the question, are easier for an agent to read correctly and harder to misrepresent. That is the same discipline that makes a page useful to a person in a hurry, so it is not wasted effort.

Common questions

Are AI browser agents safe to use? For reading, comparing and summarising, yes. The risk rises sharply the moment an agent is working inside a session that is logged in to email, banking or cloud storage, because a hijacked agent inherits those permissions.

What is prompt injection in simple terms? Someone hides text on a web page that reads like an instruction. The agent reads the page, cannot tell the difference between content and commands, and follows the planted instruction instead of yours.

Can I see when an agent has been hijacked? Usually, if you are watching. The visible symptom is the agent navigating to a site you never mentioned, or asking for a code or password it should not need. Unattended runs are where the damage happens.

Which browsers have agent features? Perplexity Comet and OpenAI-linked browsing tools are the widely discussed ones, and the major browsers are adding similar capabilities. The weakness is architectural rather than specific to one product, so it applies broadly.

Sources and further reading

Where the figures and rules above come from, so you can check them:

• OWASP 2026 assessment placing prompt injection at the centre of agentic AI risk: Help Net Security
• Indirect prompt injection observed in the wild: Cloud Security Alliance
• Defences and their limits in browser use: Anthropic
• Remote code execution in AI agent frameworks: Microsoft Security